# /etc/whp/trusted-proxies.conf
#
# CIDR allowlist of trusted reverse proxies. WHP's get_client_ip() will only
# honor the CF-Connecting-IP and X-Forwarded-For request headers when the
# direct REMOTE_ADDR matches one of these CIDRs. Any other client's
# CF-Connecting-IP / X-Forwarded-For is ignored, preventing IP spoofing that
# would bypass the brute-force lockout and the nonce IP-pin.
#
# Format:
#   - One CIDR per line (e.g. 10.0.0.0/8 or 2001:db8::/32).
#   - A bare IP without "/N" is treated as a single-address match.
#   - Lines starting with "#" and inline "# ..." comments are ignored.
#   - Blank lines are ignored.
#
# Deploy: copy this file to /etc/whp/trusted-proxies.conf and customize. If
# the live file is absent, WHP falls back to the safe defaults shown below
# (loopback + Docker bridges + RFC1918 private ranges) — sufficient for the
# standard WHP topology where Apache, PHP-FPM, HAProxy, and Cloudflare's
# Argo tunnel all run on the same host or its private network.
#
# Defaults that apply when this file is missing or empty:
#   127.0.0.0/8       # IPv4 loopback (Apache <-> PHP-FPM, local probes)
#   ::1/128           # IPv6 loopback
#   172.16.0.0/12     # Default Docker bridge networks
#   10.0.0.0/8        # Private LAN (HAProxy, internal services)
#
# To deviate from the defaults, uncomment any of the entries below or add
# additional CIDRs (for example, your specific Cloudflare egress ranges).
#
#127.0.0.0/8
#::1/128
#172.16.0.0/12
#10.0.0.0/8

# Cloudflare IPv4 ranges (https://www.cloudflare.com/ips-v4) — uncomment if
# Cloudflare proxies traffic to a public-facing host. Update periodically.
#173.245.48.0/20
#103.21.244.0/22
#103.22.200.0/22
#103.31.4.0/22
#141.101.64.0/18
#108.162.192.0/18
#190.93.240.0/20
#188.114.96.0/20
#197.234.240.0/22
#198.41.128.0/17
#162.158.0.0/15
#104.16.0.0/13
#104.24.0.0/14
#172.64.0.0/13
#131.0.72.0/22

# Cloudflare IPv6 ranges (https://www.cloudflare.com/ips-v6)
#2400:cb00::/32
#2606:4700::/32
#2803:f800::/32
#2405:b500::/32
#2405:8100::/32
#2a06:98c0::/29
#2c0f:f248::/32
